I'm having troubles connecting (meaning I can't connect to any IP or port) to my server and it appears that the problem was to do with CSF. I uninstalled CSF (by running /etc/csf/uninstall.sh) and restarted the server. I was still unable to connect. I ran iptables -F and then service iptables save. I was then able to connect, but then once I reboot the server I'm blocked again. I ran iptables -L to see if theres any rules still and I got this:
Chain INPUT (policy DROP)
target prot opt source destination
spooflist all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
DROP all -f anywhere anywhere
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 5/min burst 7 LOG level warning prefix `NULL Packets'
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN limit: avg 5/min burst 7 LOG level warning prefix `XMAS Packets'
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
LOG tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN limit: avg 5/min burst 7 LOG level warning prefix `Fin Packets Scan'
DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
DROP all -- anywhere anywhere PKTTYPE = broadcast
DROP all -- anywhere anywhere PKTTYPE = multicast
DROP all -- anywhere anywhere state INVALID
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:ssh
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:ndmp
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:http
ACCEPT tcp -- 21.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET 18.167.10.204.IN-ADDR.ARPA.HSIPT.AS46600.NET tcp dpt:https
ACCEPT icmp -- anywhere anywhere icmp echo-request state NEW,RELATED,ESTABLISHED limit: avg 30/sec burst 5
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable limit: avg 30/sec burst 5
ACCEPT icmp -- anywhere anywhere icmp redirect limit: avg 30/sec burst 5
ACCEPT icmp -- anywhere anywhere icmp time-exceeded limit: avg 30/sec burst 5
LOG all -- anywhere anywhere limit: avg 5/min burst 7 LOG level warning
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
spooflist all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
Chain spooflist (2 references)
target prot opt source destination
LOG all -- loopback/8 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- loopback/8 anywhere
LOG all -- 192.168.0.0/16 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 192.168.0.0/16 anywhere
LOG all -- 172.16.0.0/12 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 172.16.0.0/12 anywhere
LOG all -- 10.0.0.0/8 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 10.0.0.0/8 anywhere
LOG all -- link-local/16 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- link-local/16 anywhere
LOG all -- default/8 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- default/8 anywhere
LOG all -- 240.0.0.0/4 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 240.0.0.0/4 anywhere
LOG all -- 255.255.255.255 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 255.255.255.255 anywhere
LOG all -- 168.254.0.0/16 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 168.254.0.0/16 anywhere
LOG all -- base-address.mcast.net/4 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- base-address.mcast.net/4 anywhere
LOG all -- 240.0.0.0/5 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 240.0.0.0/5 anywhere
LOG all -- 248.0.0.0/5 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 248.0.0.0/5 anywhere
LOG all -- 192.0.2.0/24 anywhere LOG level warning prefix `SPOOF List Block'
DROP all -- 192.0.2.0/24 anywhere
I ran lsmod|grep ip to see what IPTables modules are loaded and it seems the same as all my other servers:
ipt_REJECT 2351 0
ipt_LOG 5845 0
ip6t_REJECT 4628 2
nf_conntrack_ipv6 8337 2
nf_defrag_ipv6 27236 1 nf_conntrack_ipv6
nf_conntrack 80390 2 nf_conntrack_ipv6,xt_state
ip6table_filter 2889 1
ip6_tables 18732 1 ip6table_filter
ipv6 334740 25 ip6t_REJECT,nf_conntrack_ipv6,nf_defrag_ipv6
Here's a list of services that run on startup (and /etc/rc/rc.local is the default file)
auditd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
blk-availability 0:off 1:on 2:on 3:on 4:on 5:on 6:off
cgconfig 0:off 1:off 2:off 3:off 4:off 5:off 6:off
crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off
mysql 0:off 1:off 2:on 3:on 4:on 5:on 6:off
named 0:off 1:off 2:on 3:on 4:on 5:on 6:off
netconsole 0:off 1:off 2:off 3:off 4:off 5:off 6:off
netfs 0:off 1:off 2:off 3:on 4:on 5:on 6:off
network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
portreserve 0:off 1:off 2:on 3:on 4:on 5:on 6:off
postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off
restorecond 0:off 1:off 2:off 3:off 4:off 5:off 6:off
rsyslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
udev-post 0:off 1:on 2:on 3:on 4:on 5:on 6:off
Some more notes:
- I had KVM and OpenVZ installed on this server but removed them. I don't see anything that would cause the rules to load, but maybe I'm not looking good enough?
- I don't see any crontab rules that would affect IPTables.
I have tried everything to remove these but they still keep on showing up after I reboot. Any ideas?
